Malware - Redirect

[dsmoothe]

Hi all:
I just completed setting up my form with Form Tools and thanks to the documentation and the forums, I was able to figure it out and get it working. However, now when I go into the manager section and click on any links I get a warning from Google that my site may contain Malware from 4safe.in and I am redirected to a site selling pills.

I never had this until I installed Form Tools on my site which is still in early stages of development. I uninstalled everything and re-downloaded and installed everything again (6hrs). Now I am getting same warning page from Google. I am running MalwareBytes and it is blocking a redirect to IP address 91.207.6.114.

I checked the code of some of the pages and php but could find out where the malware is. Has anyone experienced this before when in the forms management area? Can anyone help? Thanks

[Ben]

Hi dsmoothe,

Hmm... that's a worry.

So when you say you get a warning from Google, what do you mean exactly? So you click on a link within the Form Tools administration section but you get redirected elsewhere? Unless you have some sort of extension installed, that doesn't sound like Google - and certainly not Form Tools. It sounds like you have some malware running in your browser / operating system that's causing this behaviour.

It's possible that the pages themselves have been hacked on your website, but from what you described, I'd look at your PC environment first.

Have you tried running some spyware/malware removal scripts on your computer? (It's a PC, I assume). I'd definitely start there.

Let me know how it goes.


- Ben

[dsmoothe]

Thanks. I did run malwarebytes and a few other antivirus programs to scrub the computer. Then I uninstalled all the form tools files and re-downloaded and reinstalled. Still, when I am in the Form tools Admin section and click on a link like "Main". I get send to a page called "Malware Detected" with a big red stop and the following text:

Warning: Something's Not Right Here!
http://www.attorneyresumeservice.com contains content from 4safe.in, a site known to distribute malware. Your computer might catch a virus if you visit this site.
Google has found malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed, and perhaps try again tomorrow or go somewhere else.
We have already notified 4safe.in that we found malware on the site. For more about the problems found on 4safe.in, visit the Google Safe Browsing diagnostic page.

If you understand that visiting this site may harm your computer, proceed anyway.

Help improve detection of malware by sending additional data to Google about sites on which you see this warning. This data will be handled in accordance with the Safe Browsing privacy policies.

---

Also if I continue through the warning it takes me to some site called http://tastypills.com/. I viewed the page source and don't see any redirects. It basically happens when navigating through the administration tool. Thanks

[Ben]

Hmm... what a pain! Two questions:

- Did you download the Form Tools script from this site or from somewhere else?
- What other scripts do you have running on your server? Are other pages or script affected or just Form Tools?

Any chance you could give me temporary Form Tools admin access so I could log in and see the problem myself? (email me at ben.keen@gmail.com)

- Ben